The correct answer isB. AllowingPIIto be freely entered into prompts without safeguards is considered amajor privacy and security riskand is not a responsible governance practice.
From the AIGP ILT Guide - Generative AI & Third-Party Risk Management:
"Use of personal or sensitive information in AI prompts can result in unintended exposure, regulatory breaches, and downstream liability." The AI Governance in Practice Report2025highlights:
"PII should be minimized or protected by design. Prompt engineering should prevent entry of personally identifiable data unless legally and technically safeguarded." A, C, and D are established best practices under responsible AI procurement and use.